Post #2093648

This comment... Confuses me. > Black box testing is MUCH harder than white box testing, especially as, and I hate to say it, AI based security scanners become better and better at identifying flaws in source code. Having more information about your target is always the first step in penetration testing, and more information is ALWAYS better. This is exactly why security by obscurity is a valid tactic. It hides information and makes a system harder to attack. > Absolute security is achievable, but comes with costs. If I'm willing to airgap everything and never go online, only using my own code, my device will be safe. No, it's not. Every system has flaws. Using your own code is especially a bad idea, as it is much more likely to be flawed than a 20 yo open source project. Your airgapped device may be secure from remote attacks, since it is not connected to any network, but if it is stolen, that means nothing. Absolute security is *impossible*.